linux-kernel - Re: [PATCH v2] mtd: core: always verify OOB offset in mtd_check_oob

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <454e092d-5b75-4758-a0e9-dfbb7bf271d7@ti.com>
Date: Thu, 11 Sep 2025 11:52:27 +0530
From: Santhosh Kumar K <s-k6@...com>
To: Miquel Raynal <miquel.raynal@...tlin.com>,
        Richard Weinberger
	<richard@....at>,
        Vignesh Raghavendra <vigneshr@...com>, Gabor Juhos
	<j4g8y7@...il.com>
CC: <linux-mtd@...ts.infradead.org>, <linux-kernel@...r.kernel.org>,
        <stable@...r.kernel.org>, Daniel Golle <daniel@...rotopia.org>,
        <s-k6@...com>
Subject: Re: [PATCH v2] mtd: core: always verify OOB offset in
 mtd_check_oob_ops()

Hello,

On 05/09/25 20:25, Miquel Raynal wrote:
> On Mon, 01 Sep 2025 16:24:35 +0200, Gabor Juhos wrote:
>> Using an OOB offset past end of the available OOB data is invalid,
>> irregardless of whether the 'ooblen' is set in the ops or not. Move
>> the relevant check out from the if statement to always verify that.
>>
>> The 'oobtest' module executes four tests to verify how reading/writing
>> OOB data past end of the devices is handled. It expects errors in case
>> of these tests, but this expectation fails in the last two tests on
>> MTD devices, which have no OOB bytes available.
>>
>> [...]
> 
> Applied to mtd/next, thanks!
> 
> [1/1] mtd: core: always verify OOB offset in mtd_check_oob_ops()
>        commit: bf7d0543b2602be5cb450d8ec5a8710787806f88

I'm seeing a failure in SPI NOR flashes due to this patch:
(Tested on AM62x SK with S28HS512T OSPI NOR flash)

root@...2xx-evm:~# uname -a
Linux am62xx-evm 6.17.0-rc1-00011-gbf7d0543b260 #3 SMP PREEMPT Wed Sep 
10 20:44:34 IST 2025 aarch64 GNU/Linux
root@...2xx-evm:~# dmesg | grep mtd
[    8.018107] I/O error, dev mtdblock6, sector 0 op 0x0:(READ) flags 
0x80700 phys_seg 1 prio class 2
[    8.032806] I/O error, dev mtdblock6, sector 0 op 0x0:(READ) flags 
0x0 phys_seg 1 prio class 2
[    8.043229] Buffer I/O error on dev mtdblock6, logical block 0, async 
page read
[    8.055082] I/O error, dev mtdblock4, sector 0 op 0x0:(READ) flags 
0x80700 phys_seg 1 prio class 2
[    8.065883] I/O error, dev mtdblock4, sector 0 op 0x0:(READ) flags 
0x0 phys_seg 1 prio class 2
[    8.075022] Buffer I/O error on dev mtdblock4, logical block 0, async 
page read
[    8.381213] I/O error, dev mtdblock6, sector 0 op 0x0:(READ) flags 
0x80700 phys_seg 1 prio class 2
[    8.394621] I/O error, dev mtdblock2, sector 0 op 0x0:(READ) flags 
0x80700 phys_seg 1 prio class 2
[    8.394704] I/O error, dev mtdblock2, sector 0 op 0x0:(READ) flags 
0x0 phys_seg 1 prio class 2
[    8.394714] Buffer I/O error on dev mtdblock2, logical block 0, async 
page read
[    8.410152] I/O error, dev mtdblock0, sector 0 op 0x0:(READ) flags 
0x80700 phys_seg 1 prio class 2
[    8.456064] I/O error, dev mtdblock0, sector 0 op 0x0:(READ) flags 
0x0 phys_seg 1 prio class 2
[    8.465774] Buffer I/O error on dev mtdblock0, logical block 0, async 
page read
[    8.469771] I/O error, dev mtdblock6, sector 0 op 0x0:(READ) flags 
0x0 phys_seg 1 prio class 2
[    8.469804] Buffer I/O error on dev mtdblock6, logical block 0, async 
page read
[    8.505866] Buffer I/O error on dev mtdblock5, logical block 0, async 
page read
[    8.522665] Buffer I/O error on dev mtdblock4, logical block 0, async 
page read
[    8.845572] Buffer I/O error on dev mtdblock3, logical block 0, async 
page read
[    8.855938] Buffer I/O error on dev mtdblock1, logical block 0, async 
page read
[    8.878292] Buffer I/O error on dev mtdblock2, logical block 0, async 
page read
root@...2xx-evm:~# hexdump /dev/mtd6
hexdump: /dev/mtd6: Invalid argument
root@...2xx-evm:~#


Reverting this works fine:

root@...2xx-evm:~# uname -a
Linux am62xx-evm 6.17.0-rc5-next-20250910-00001-g5f216cdf2764 #5 SMP 
PREEMPT Thu Sep 11 11:38:06 IST 2025 aarch64 GNU/Linux
root@...2xx-evm:~# dmesg | grep mtd
root@...2xx-evm:~# hexdump /dev/mtd6
0000000 ffff ffff ffff ffff ffff ffff ffff ffff
*
0040000
root@...2xx-evm:~#

Regards,
Santhosh.

> 
> Patche(s) should be available on mtd/linux.git and will be
> part of the next PR (provided that no robot complains by then).
> 
> Kind regards,
> Miquèl
> 
>